OT Security Engineer (BMS/EPMS) recruiters who bring you a focused shortlist
Data Center Headhunters are OT Security Engineer (BMS/EPMS) recruiters for data center owners, operators and builders. Send us the open role and we find working OT Security Engineer (BMS/EPMS) candidates, qualify each one live and give you a short list to interview. No upfront fee. You pay only if you hire.
You need someone who can protect building and power control networks without breaking the equipment that keeps the facility running, and that balance is rare.
This is what we do all day: recruit data center professionals.
No postings. No stacks of resumes. No chasing. You interview a short list.
No upfront fee. You pay only if you hire.
No upfront fee. You pay only if you hire.
We offer a candidate replacement guarantee on standard search agreements. The applicable period and exact terms are set out in the signed client recruiting agreement.
- No upfront fee
- Pay only if you hire
- Data centers only, construction to operations
- Local and 100% travel candidates
- Replacement guarantee on standard searches
- OT Security Engineer (BMS/EPMS)
What does this hire really come down to?
An OT security engineer for BMS and EPMS secures the networks and devices that control cooling and power: segmentation, remote access, patching decisions, asset inventory, logging and incident response. It differs from corporate IT security because availability comes first and many devices cannot be scanned or patched without risk.
The remit question is authority. Some engineers set policy and review designs. Others implement firewall rules or manage remote vendor access. Ask what the candidate could change on a live controls network and who approved it. Someone who ran an active scan against a running controller to find out what it was has learned a lesson, so ask what it was.
Expect a split between IT trained and controls trained candidates. The first brings security tools and frameworks but may not understand why a chiller controller cannot reboot. The second knows the plant but may be thin on network design. Decide which you can coach.
What do we check before you see anyone?
Ask how they built an asset inventory for devices that cannot be scanned actively. Ask how they handle vendor remote access, including approval, monitoring and removal. Ask how they decided whether to patch a control device and what testing they required first.
- Ask how they built an asset inventory for devices that cannot be scanned actively.
- Ask how they handle vendor remote access, including approval, monitoring and removal.
- Ask how they decided whether to patch a control device and what testing they required first.
- Ask what they did when a security requirement conflicted with an operations requirement.
Where do we find these candidates?
We look at industrial control system security teams, utilities and manufacturing automation groups, where availability first thinking is normal. We also approach network engineers from controls integrators and IT security staff who have supported operational sites, and we screen them for plant understanding.
- We look at industrial control system security teams, utilities and manufacturing automation groups, where availability first thinking is normal.
- We also approach network engineers from controls integrators and IT security staff who have supported operational sites, and we screen them for plant understanding.
Which hiring mistakes should you avoid?
Do not hire an IT security specialist and give them authority over production controls without operations input. Do not overlook vendor access, which is often the largest gap. Do not treat certifications as proof of OT experience. Ask for work they did.
- Hiring an IT security specialist and giving them authority over production controls without operations input.
- Overlooking vendor access, which is often the largest gap.
- Treating certifications as proof of OT experience. Ask for work they did.
Your search in 3 steps
- Define the control boundary
We ask what the engineer can change, who approves, and who owns the network.
- Weigh the background
We tell you which candidates lean IT and which lean controls, and what each will need to learn.
- Screen for judgment under conflict
We test how candidates resolve a security and uptime clash. We then help you describe how this role works with controls and facilities teams.
Interview questions worth asking
Ask how they would find out what is on a controls network when active scanning is not allowed. Listen for passive monitoring, switch records and walking the rooms with the technicians.
Ask what they would do about a vendor who insists on permanent remote access to a chiller plant. A good answer includes time limited access, logging, a named approver and a conversation about why the vendor needs it.
Ask how they would explain a firewall change to a facilities manager who fears an outage. Their ability to translate matters as much as the rule they write, because operations staff will route around controls they do not understand.
Adjacent roles
The corporate security team owns policy for business systems, while the controls engineer owns the plant logic. The OT security engineer works across both and needs standing in each. Ask whom they reported to and who could overrule them, since a role with no authority becomes a reviewer of reports nobody reads.
Ask also about incident drills. Someone who has rehearsed what to do when a controller behaves oddly, including who isolates the segment and who tells operations, has thought about the job the way it is performed. Certificates in security frameworks help, but they say little about plant work, so ask for the work.
Where do we fill this role?
What does BLS publish for this role?
The figure below comes from the national OEWS row for Information Security Analysts. Read the mapping badge before using it in a budget. A broader occupation can include jobs outside data centers. Compare your seat’s responsibilities and pay basis with the published occupation rather than treating the median as an offer quote.
Broader occupation. Information Security Analysts is a broader occupation based on the work described, not a separate data center wage series. BLS does not distinguish this title, experience level, shift, credentials or data center employers. Confirm the actual duties before using this comparison.
| Area | Median annual wage | BLS occupation |
|---|---|---|
| United States | $129,180 | Information Security Analysts (SOC 15-1212) |
Source: U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics, May 2025. SOC 15-1212 Information Security Analysts, United States. View this release at BLS.
Not ready to start a search?
We tell you where qualified OT Security Engineer (BMS/EPMS) are working in your area and what it takes to move them. No fee, no obligation.
Paste or upload your JD. We flag what will put strong candidates off. No fee, no obligation.
Open roles
Questions
When could an OT security shortlist be ready?
This is a small pool, so timing depends on whether you accept IT trained or controls trained backgrounds. We will give a view after scoping without a fixed date. Broader flexibility helps.
Will these engineers weigh a counteroffer?
In a scarce field employers often counter. We ask each candidate what sits behind the search and whether a counter could settle it. Authority over decisions is often the cause.
Do OT security engineers relocate or work remotely?
Some relocate, but many already work remotely or hybrid. We confirm before you interview. Facility visits may still be required for assessments.
Is travel part of this role?
Yes when assessing several sites or supporting a build. State the pattern and expenses plainly. Remote review covers a good part of the work.
How can I test fit on my control networks?
Ask how they would secure a vendor's remote connection to a chiller plant without risking an outage. The answer shows whether availability comes first in their thinking. We can help structure it.
How are the search terms explained?
The approved terms shown on this page apply. Ask any question about them at the start.
Start your search
Which related roles might you also need?
Related hiring situations
How a search runs
How does The Six-Step Search work?
Every search runs the same six steps. We agree the brief with you, map where the people work, find direct contact routes, reach out personally and repeatedly, then qualify each candidate live. You only see a short list of people who fit, with notes on each, and we stay with you through offer and start.
- 01
Search Calibration
You get: A written brief you sign off on: scope, must-haves, pay band and who not to approach.
- 02
Market Mapping
You get: A map of the companies and projects where your future hire is working today.
- 03
Professional Contact Intelligence
You get: Verified direct contact routes to the people on that map, not job board replies.
- 04
Persistent Personalized Outreach
You get: Repeated, role-specific outreach to people who are not looking, in your words.
- 05
Live Candidate Qualification
You get: Each candidate is screened live against your brief before you hear their name.
- 06
Candidate Intelligence and Process Support
You get: A short list with candidate briefs, then support through interviews, offer and start.
What should you know before you send a role?
What does it cost to hire through Data Center Headhunters?
No upfront fee. You pay only if you hire. Fee terms are set out in the signed recruiting agreement.
Is there a guarantee?
We offer a candidate replacement guarantee on standard search agreements. The applicable period and exact terms are set out in the signed client recruiting agreement.
What don't you do?
We do not post your job on boards, send stacks of unscreened resumes or charge an upfront fee. We do not approach candidates for your search before the brief is agreed with you.
Need this person?
No upfront fee. You pay only if you hire.
We offer a candidate replacement guarantee on standard search agreements. The applicable period and exact terms are set out in the signed client recruiting agreement.